By publication date

Exploited and new serious CVEs: February 2016

65 records · 5 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2016-0861Proof of concept	General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to executege · ups snmp web adapter firmware · CWE-77 RCE Command injection	High8.8	—	14.2%	Feb 5, 2016
49Plan	CVE-2016-0801Proof of concept	The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackapple · iphone os · CWE-20 pre-auth RCE	Critical9.8	—	33.1%	Feb 6, 2016
37Monitor	CVE-2016-0022No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Omicrosoft · office compatibility pack · CWE-119 RCE Memory safety	High7.8	—	19.0%	Feb 10, 2016
35Monitor	CVE-2016-0033No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows microsoft · .net framework · CWE-94 pre-auth RCE Denial of service	High7.5	—	17.6%	Feb 10, 2016
35Monitor	CVE-2016-0036No exploit	The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 almicrosoft · windows 10 · CWE-264 pre-auth RCE	High8.1	—	11.3%	Feb 10, 2016
38Monitor	CVE-2016-0037No exploit	The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows microsoft · windows server 2012 · CWE-20 Pre-auth Denial of service	High7.5	—	25.6%	Feb 10, 2016
37Monitor	CVE-2016-0038No exploit	Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold andmicrosoft · windows 10 · CWE-119 RCE Memory safety	High7.8	—	19.9%	Feb 10, 2016
68This week	CVE-2016-0040Weaponized	The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via amicrosoft · windows 7 Local privilege escalation	High7.8	KEV	24.2%	Feb 10, 2016
56Plan	CVE-2016-0041Weaponized	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1microsoft · internet explorer RCE Local privilege escalation	High7.8	—	82.9%	Feb 10, 2016
34Monitor	CVE-2016-0044No exploit	Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (Symicrosoft · windows 8.1 · CWE-20 Pre-auth Denial of service	High7.5	—	14.1%	Feb 10, 2016
39Monitor	CVE-2016-0046No exploit	Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code vmicrosoft · windows 10 · CWE-20 RCE	High7.8	—	26.1%	Feb 10, 2016
36Monitor	CVE-2016-0047No exploit	WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information frommicrosoft · .net framework · CWE-200 Pre-auth Info leak	High7.5	—	20.0%	Feb 10, 2016
28Monitor	CVE-2016-0049Proof of concept	Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, anmicrosoft · windows 10 · CWE-255 Auth bypass	Medium6.2	—	13.0%	Feb 10, 2016
26Monitor	CVE-2016-0050No exploit	Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which almicrosoft · windows server 2008 · CWE-20 Pre-auth Denial of service	Medium5.3	—	17.8%	Feb 10, 2016
40Plan	CVE-2016-0051Weaponized	The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold amicrosoft · windows 10 · CWE-264 Local privilege escalation	High7.8	—	22.8%	Feb 10, 2016
37Monitor	CVE-2016-0052No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Omicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	19.0%	Feb 10, 2016
37Monitor	CVE-2016-0053No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viemicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	19.0%	Feb 10, 2016
36Monitor	CVE-2016-0054No exploit	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compmicrosoft · excel · CWE-119 RCE Memory safety	High7.8	—	15.6%	Feb 10, 2016
36Monitor	CVE-2016-0056No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allowmicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	16.0%	Feb 10, 2016
38Monitor	CVE-2016-0058No exploit	Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execmicrosoft · windows 10 · CWE-119 RCE Memory safety	High7.8	—	22.5%	Feb 10, 2016
24Monitor	CVE-2016-0059No exploit	The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from procesmicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	23.1%	Feb 10, 2016
43Plan	CVE-2016-0060No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	27.1%	Feb 10, 2016
41Plan	CVE-2016-0061No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	21.3%	Feb 10, 2016
41Plan	CVE-2016-0062No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	21.3%	Feb 10, 2016
47Plan	CVE-2016-0063Proof of concept	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	39.1%	Feb 10, 2016
39Monitor	CVE-2016-0064No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.1%	Feb 10, 2016
39Monitor	CVE-2016-0067No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.1%	Feb 10, 2016
39Monitor	CVE-2016-0071No exploit	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.1%	Feb 10, 2016
41Plan	CVE-2016-0072No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	20.2%	Feb 10, 2016
22Monitor	CVE-2016-0080No exploit	Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection microsoft · edge · CWE-200 Pre-auth Info leak	Medium4.3	—	15.0%	Feb 10, 2016
40Plan	CVE-2016-0084No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	17.3%	Feb 10, 2016
36Monitor	CVE-2016-0055No exploit	Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corrmicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	15.9%	Feb 10, 2016
45Plan	CVE-2016-0951Proof of concept	Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code oadobe · bridge cc · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	19.6%	Feb 10, 2016
45Plan	CVE-2016-0952Proof of concept	Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code oadobe · bridge cc · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	19.6%	Feb 10, 2016
45Plan	CVE-2016-0953Proof of concept	Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code oadobe · bridge cc · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	19.6%	Feb 10, 2016
45Plan	CVE-2016-0956Proof of concept	The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to oapache · sling · CWE-200 Pre-auth Info leak	High7.5	—	51.1%	Feb 10, 2016
46Plan	CVE-2016-0957Proof of concept	Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote atadobe · dispatcher Pre-auth	High7.5	—	51.9%	Feb 10, 2016
41Plan	CVE-2016-0964Proof of concept	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR befadobe · flash player · CWE-787 pre-auth RCE Memory safety	High8.8	—	19.6%	Feb 10, 2016
41Plan	CVE-2016-0965Proof of concept	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR befadobe · flash player · CWE-787 pre-auth RCE Memory safety	High8.8	—	19.6%	Feb 10, 2016
41Plan	CVE-2016-0967Proof of concept	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR befadobe · flash player · CWE-787 pre-auth RCE Memory safety	High8.8	—	19.6%	Feb 10, 2016
45Plan	CVE-2016-0971Proof of concept	Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.2adobe · flash player · CWE-787 pre-auth RCE Memory safety	High8.8	—	33.4%	Feb 10, 2016
44Plan	CVE-2016-0974Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	—	30.7%	Feb 10, 2016
81Now	CVE-2016-0984Weaponized	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	KEV	54.5%	Feb 10, 2016
43Plan	CVE-2016-0985Proof of concept	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR befadobe · flash player · CWE-843 pre-auth RCE	High8.8	—	26.0%	Feb 10, 2016
61This week	CVE-2016-1287Proof of concept	Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9cisco · adaptive security appliance software · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	74.2%	Feb 11, 2016
66This week	CVE-2016-1524Weaponized	Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to executenetgear · prosafe network management software 300 pre-auth RCE File upload	Critical9.6	—	94.1%	Feb 12, 2016
60This week	CVE-2016-1525Weaponized	Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticatnetgear · prosafe network management software 300 · CWE-22 Pre-auth Path traversal	High8.6	—	75.0%	Feb 12, 2016
26Monitor	CVE-2015-3197Proof of concept	ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for manopenssl · openssl · CWE-200 Pre-auth Info leak	Medium5.9	—	10.7%	Feb 14, 2016
39Monitor	CVE-2016-0701No exploit	The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for openssl · openssl · CWE-200 Pre-auth Info leak	Low3.7	—	83.6%	Feb 14, 2016
55Plan	CVE-2016-0742No exploit	The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereferencef5 · nginx · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	82.3%	Feb 15, 2016
89Now	CVE-2016-0752Weaponized	Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, anrubyonrails · rails · CWE-22 Pre-auth Path traversal	High7.5	KEV	95.5%	Feb 15, 2016
90Now	CVE-2016-2386Weaponized	SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands vsap · netweaver application server java · CWE-89 pre-auth RCE SQL injection	Critical9.8	KEV	71.5%	Feb 16, 2016
67This week	CVE-2016-2388Weaponized	The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a craftedsap · netweaver application server java · CWE-200 Pre-auth Info leak	Medium5.3	KEV	52.2%	Feb 16, 2016
42Plan	CVE-2016-2389Proof of concept	Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fosap · netweaver · CWE-22 Pre-auth Path traversal	High7.5	—	41.4%	Feb 16, 2016
59Plan	CVE-2015-7547Proof of concept	Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc gnu · glibc · CWE-119 pre-auth RCE Memory safety	High8.1	—	90.9%	Feb 18, 2016
39Monitor	CVE-2016-0068No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Expmicrosoft · internet explorer · CWE-264 Pre-auth	High8.8	—	14.5%	Feb 18, 2016
41Plan	CVE-2016-0069No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Expmicrosoft · internet explorer · CWE-264 Pre-auth	High8.8	—	18.7%	Feb 18, 2016
48Plan	CVE-2015-8277Proof of concept	Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote atflexerasoftware · flexnet publisher · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	28.6%	Feb 23, 2016
21Monitor	CVE-2015-5174No exploit	Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows reapache · tomcat · CWE-22 Path traversal	Medium4.3	—	12.5%	Feb 25, 2016
27Monitor	CVE-2015-5345No exploit	The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects bapache · tomcat · CWE-22 Pre-auth Path traversal	Medium5.3	—	18.3%	Feb 25, 2016
35Monitor	CVE-2015-5346No exploit	Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settinapache · tomcat Pre-auth	High8.1	—	10.5%	Feb 25, 2016
39Monitor	CVE-2016-0714Proof of concept	The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 misapache · tomcat · CWE-264 RCE	High8.8	—	13.0%	Feb 25, 2016
28Monitor	CVE-2016-0763No exploit	The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, andapache · tomcat · CWE-264	Medium6.3	—	11.2%	Feb 25, 2016
39Monitor	CVE-2016-2569Proof of concept	Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial squid-cache · squid · CWE-20 Pre-auth Denial of service	High7.5	—	31.1%	Feb 27, 2016
33Monitor	CVE-2016-2572No exploit	http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to causesquid-cache · squid · CWE-20 Pre-auth Denial of service	High7.5	—	10.1%	Feb 27, 2016

CVE-2016-0861
39Monitor
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute
HighCVSS 8.8Proof of conceptEPSS 14%
- RCE
- Command injection
ge · ups snmp web adapter firmwareFeb 5, 2016
CVE-2016-0801
49Plan
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attack
CriticalCVSS 9.8Proof of conceptEPSS 33%
- pre-auth RCE
apple · iphone osFeb 6, 2016
CVE-2016-0022
37Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · office compatibility packFeb 10, 2016
CVE-2016-0033
35Monitor
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows
HighCVSS 7.5No exploitEPSS 17%
- pre-auth RCE
- Denial of service
microsoft · .net frameworkFeb 10, 2016
CVE-2016-0036
35Monitor
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 al
HighCVSS 8.1No exploitEPSS 11%
- pre-auth RCE
microsoft · windows 10Feb 10, 2016
CVE-2016-0037
38Monitor
The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows
HighCVSS 7.5No exploitEPSS 25%
- Pre-auth
- Denial of service
microsoft · windows server 2012Feb 10, 2016
CVE-2016-0038
37Monitor
Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · windows 10Feb 10, 2016
CVE-2016-0040
68This week
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a
HighCVSS 7.8KEVWeaponizedEPSS 24%
- Local privilege escalation
microsoft · windows 7Feb 10, 2016
CVE-2016-0041
56Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1
HighCVSS 7.8WeaponizedEPSS 82%
- RCE
- Local privilege escalation
microsoft · internet explorerFeb 10, 2016
CVE-2016-0044
34Monitor
Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (Sy
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
- Denial of service
microsoft · windows 8.1Feb 10, 2016
CVE-2016-0046
39Monitor
Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code v
HighCVSS 7.8No exploitEPSS 26%
- RCE
microsoft · windows 10Feb 10, 2016
CVE-2016-0047
36Monitor
WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from
HighCVSS 7.5No exploitEPSS 20%
- Pre-auth
- Info leak
microsoft · .net frameworkFeb 10, 2016
CVE-2016-0049
28Monitor
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, an
MediumCVSS 6.2Proof of conceptEPSS 13%
- Auth bypass
microsoft · windows 10Feb 10, 2016
CVE-2016-0050
26Monitor
Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which al
MediumCVSS 5.3No exploitEPSS 17%
- Pre-auth
- Denial of service
microsoft · windows server 2008Feb 10, 2016
CVE-2016-0051
40Plan
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a
HighCVSS 7.8WeaponizedEPSS 22%
- Local privilege escalation
microsoft · windows 10Feb 10, 2016
CVE-2016-0052
37Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · officeFeb 10, 2016
CVE-2016-0053
37Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Vie
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · officeFeb 10, 2016
CVE-2016-0054
36Monitor
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp
HighCVSS 7.8No exploitEPSS 15%
- RCE
- Memory safety
microsoft · excelFeb 10, 2016
CVE-2016-0056
36Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow
HighCVSS 7.8No exploitEPSS 16%
- RCE
- Memory safety
microsoft · officeFeb 10, 2016
CVE-2016-0058
38Monitor
Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to exec
HighCVSS 7.8No exploitEPSS 22%
- RCE
- Memory safety
microsoft · windows 10Feb 10, 2016
CVE-2016-0059
24Monitor
The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from proces
MediumCVSS 4.3No exploitEPSS 23%
- Pre-auth
- Info leak
microsoft · internet explorerFeb 10, 2016
CVE-2016-0060
43Plan
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
HighCVSS 8.8No exploitEPSS 27%
- pre-auth RCE
- Memory safety
microsoft · edgeFeb 10, 2016
CVE-2016-0061
41Plan
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
HighCVSS 8.8No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · edgeFeb 10, 2016
CVE-2016-0062
41Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
HighCVSS 8.8No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · edgeFeb 10, 2016
CVE-2016-0063
47Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 8.8Proof of conceptEPSS 39%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 10, 2016
CVE-2016-0064
39Monitor
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 10, 2016
CVE-2016-0067
39Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 10, 2016
CVE-2016-0071
39Monitor
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 10, 2016
CVE-2016-0072
41Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 8.8No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 10, 2016
CVE-2016-0080
22Monitor
Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection
MediumCVSS 4.3No exploitEPSS 15%
- Pre-auth
- Info leak
microsoft · edgeFeb 10, 2016
CVE-2016-0084
40Plan
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 8.8No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · edgeFeb 10, 2016
CVE-2016-0055
36Monitor
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corr
HighCVSS 7.8No exploitEPSS 15%
- RCE
- Memory safety
microsoft · officeFeb 10, 2016
CVE-2016-0951
45Plan
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · bridge ccFeb 10, 2016
CVE-2016-0952
45Plan
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · bridge ccFeb 10, 2016
CVE-2016-0953
45Plan
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · bridge ccFeb 10, 2016
CVE-2016-0956
45Plan
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to o
HighCVSS 7.5Proof of conceptEPSS 51%
- Pre-auth
- Info leak
apache · slingFeb 10, 2016
CVE-2016-0957
46Plan
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote at
HighCVSS 7.5Proof of conceptEPSS 51%
- Pre-auth
adobe · dispatcherFeb 10, 2016
CVE-2016-0964
41Plan
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0965
41Plan
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0967
41Plan
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0971
45Plan
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.2
HighCVSS 8.8Proof of conceptEPSS 33%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0974
44Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2
HighCVSS 8.8Proof of conceptEPSS 30%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0984
81Now
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2
HighCVSS 8.8KEVWeaponizedEPSS 54%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 10, 2016
CVE-2016-0985
43Plan
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 26%
- pre-auth RCE
adobe · flash playerFeb 10, 2016
CVE-2016-1287
61This week
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9
CriticalCVSS 9.8Proof of conceptEPSS 74%
- pre-auth RCE
- Memory safety
cisco · adaptive security appliance softwareFeb 11, 2016
CVE-2016-1524
66This week
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute
CriticalCVSS 9.6WeaponizedEPSS 94%
- pre-auth RCE
- File upload
netgear · prosafe network management software 300Feb 12, 2016
CVE-2016-1525
60This week
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticat
HighCVSS 8.6WeaponizedEPSS 75%
- Pre-auth
- Path traversal
netgear · prosafe network management software 300Feb 12, 2016
CVE-2015-3197
26Monitor
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man
MediumCVSS 5.9Proof of conceptEPSS 10%
- Pre-auth
- Info leak
openssl · opensslFeb 14, 2016
CVE-2016-0701
39Monitor
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for
LowCVSS 3.7No exploitEPSS 83%
- Pre-auth
- Info leak
openssl · opensslFeb 14, 2016
CVE-2016-0742
55Plan
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference
HighCVSS 7.5No exploitEPSS 82%
- Pre-auth
- Memory safety
- Denial of service
f5 · nginxFeb 15, 2016
CVE-2016-0752
89Now
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an
HighCVSS 7.5KEVWeaponizedEPSS 95%
- Pre-auth
- Path traversal
rubyonrails · railsFeb 15, 2016
CVE-2016-2386
90Now
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v
CriticalCVSS 9.8KEVWeaponizedEPSS 71%
- pre-auth RCE
- SQL injection
sap · netweaver application server javaFeb 16, 2016
CVE-2016-2388
67This week
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted
MediumCVSS 5.3KEVWeaponizedEPSS 52%
- Pre-auth
- Info leak
sap · netweaver application server javaFeb 16, 2016
CVE-2016-2389
42Plan
Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fo
HighCVSS 7.5Proof of conceptEPSS 41%
- Pre-auth
- Path traversal
sap · netweaverFeb 16, 2016
CVE-2015-7547
59Plan
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc
HighCVSS 8.1Proof of conceptEPSS 90%
- pre-auth RCE
- Memory safety
gnu · glibcFeb 18, 2016
CVE-2016-0068
39Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Exp
HighCVSS 8.8No exploitEPSS 14%
- Pre-auth
microsoft · internet explorerFeb 18, 2016
CVE-2016-0069
41Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Exp
HighCVSS 8.8No exploitEPSS 18%
- Pre-auth
microsoft · internet explorerFeb 18, 2016
CVE-2015-8277
48Plan
Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote at
CriticalCVSS 9.8Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
flexerasoftware · flexnet publisherFeb 23, 2016
CVE-2015-5174
21Monitor
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows re
MediumCVSS 4.3No exploitEPSS 12%
- Path traversal
apache · tomcatFeb 25, 2016
CVE-2015-5345
27Monitor
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects b
MediumCVSS 5.3No exploitEPSS 18%
- Pre-auth
- Path traversal
apache · tomcatFeb 25, 2016
CVE-2015-5346
35Monitor
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settin
HighCVSS 8.1No exploitEPSS 10%
- Pre-auth
apache · tomcatFeb 25, 2016
CVE-2016-0714
39Monitor
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mis
HighCVSS 8.8Proof of conceptEPSS 13%
- RCE
apache · tomcatFeb 25, 2016
CVE-2016-0763
28Monitor
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and
MediumCVSS 6.3No exploitEPSS 11%
apache · tomcatFeb 25, 2016
CVE-2016-2569
39Monitor
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial
HighCVSS 7.5Proof of conceptEPSS 31%
- Pre-auth
- Denial of service
squid-cache · squidFeb 27, 2016
CVE-2016-2572
33Monitor
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Denial of service
squid-cache · squidFeb 27, 2016